CWE-252 未加检查的返回值 类漏洞列表 71

CWE：CWE-252 Unchecked Return Value（未检查返回值） 英文：The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. 译文：产品未检查方法或函数的返回值，这可能导致其无法检测到意外状态和条件。 Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges. 译文：程序员常见的两种假设是“此函数调用绝不会失败”以及“此函数调用失败也无所谓”。如果攻击者能够强制函数失败，或以非预期方式返回一个值，那么后续的程序逻辑可能会导致漏洞，因为产品并未处于程序员所假设的状态。例如，如果程序调用一个函数来降低权限，但未检查返回码以确保权限已成功降低，则程序将继续以较高权限运行。